void ed_mul_basic(ed_t r, const ed_t p, const bn_t k) {
ed_t t;
ed_null(t);
if (bn_is_zero(k) || ed_is_infty(p)) {
ed_set_infty(r);
return;
}
TRY {
ed_new(t);
ed_copy(t, p);
for (int i = bn_bits(k) - 2; i >= 0; i--) {
ed_dbl(t, t);
if (bn_get_bit(k, i)) {
ed_add(t, t, p);
}
}
ed_norm(r, t);
if (bn_sign(k) == RLC_NEG) {
ed_neg(r, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(t);
}
}
void ed_mul_monty(ed_t r, const ed_t p, const bn_t k) {
ed_t t[2];
ed_null(t[0]);
ed_null(t[1]);
if (bn_is_zero(k) || ed_is_infty(p)) {
ed_set_infty(r);
return;
}
TRY {
ed_new(t[0]);
ed_new(t[1]);
ed_set_infty(t[0]);
ed_copy(t[1], p);
for (int i = bn_bits(k) - 1; i >= 0; i--) {
int j = bn_get_bit(k, i);
dv_swap_cond(t[0]->x, t[1]->x, RLC_FP_DIGS, j ^ 1);
dv_swap_cond(t[0]->y, t[1]->y, RLC_FP_DIGS, j ^ 1);
dv_swap_cond(t[0]->z, t[1]->z, RLC_FP_DIGS, j ^ 1);
#if ED_ADD == EXTND
dv_swap_cond(t[0]->t, t[1]->t, RLC_FP_DIGS, j ^ 1);
#endif
ed_add(t[0], t[0], t[1]);
ed_dbl(t[1], t[1]);
dv_swap_cond(t[0]->x, t[1]->x, RLC_FP_DIGS, j ^ 1);
dv_swap_cond(t[0]->y, t[1]->y, RLC_FP_DIGS, j ^ 1);
dv_swap_cond(t[0]->z, t[1]->z, RLC_FP_DIGS, j ^ 1);
#if ED_ADD == EXTND
dv_swap_cond(t[0]->t, t[1]->t, RLC_FP_DIGS, j ^ 1);
#endif
}
ed_norm(r, t[0]);
if (bn_sign(k) == RLC_NEG) {
ed_neg(r, r);
}
} CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
ed_free(t[1]);
ed_free(t[0]);
}
}
/**
* Multiplies a prime elliptic curve point by an integer using the COMBS
* method.
*
* @param[out] r - the result.
* @param[in] t - the precomputed table.
* @param[in] k - the integer.
*/
static void ed_mul_combs_endom(ed_t r, const ed_t *t, const bn_t k) {
int i, j, l, w0, w1, n0, n1, p0, p1, s0, s1;
bn_t n, k0, k1, v1[3], v2[3];
ed_t u;
bn_null(n);
bn_null(k0);
bn_null(k1);
ed_null(u);
TRY {
bn_new(n);
bn_new(k0);
bn_new(k1);
ed_new(u);
for (i = 0; i < 3; i++) {
bn_null(v1[i]);
bn_null(v2[i]);
bn_new(v1[i]);
bn_new(v2[i]);
}
ed_curve_get_ord(n);
ed_curve_get_v1(v1);
ed_curve_get_v2(v2);
l = bn_bits(n);
l = ((l % (2 * ED_DEPTH)) ==
0 ? (l / (2 * ED_DEPTH)) : (l / (2 * ED_DEPTH)) + 1);
bn_rec_glv(k0, k1, k, n, (const bn_t *)v1, (const bn_t *)v2);
s0 = bn_sign(k0);
s1 = bn_sign(k1);
bn_abs(k0, k0);
bn_abs(k1, k1);
n0 = bn_bits(k0);
n1 = bn_bits(k1);
p0 = (ED_DEPTH) * l - 1;
ed_set_infty(r);
for (i = l - 1; i >= 0; i--) {
ed_dbl(r, r);
w0 = 0;
w1 = 0;
p1 = p0--;
for (j = ED_DEPTH - 1; j >= 0; j--, p1 -= l) {
w0 = w0 << 1;
w1 = w1 << 1;
if (p1 < n0 && bn_get_bit(k0, p1)) {
w0 = w0 | 1;
}
if (p1 < n1 && bn_get_bit(k1, p1)) {
w1 = w1 | 1;
}
}
if (w0 > 0) {
if (s0 == BN_POS) {
ed_add(r, r, t[w0]);
} else {
ed_sub(r, r, t[w0]);
}
}
if (w1 > 0) {
ed_copy(u, t[w1]);
fp_mul(u->x, u->x, ed_curve_get_beta());
if (s1 == BN_NEG) {
ed_neg(u, u);
}
ed_add(r, r, u);
}
}
ed_norm(r, r);
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
bn_free(n);
bn_free(k0);
bn_free(k1);
ed_free(u);
for (i = 0; i < 3; i++) {
bn_free(v1[i]);
bn_free(v2[i]);
}
}
}
static void ed_mul_naf_imp(ed_t r, const ed_t p, const bn_t k) {
int l, i, n;
int8_t naf[RLC_FP_BITS + 1];
ed_t t[1 << (ED_WIDTH - 2)];
if (bn_is_zero(k)) {
ed_set_infty(r);
return;
}
TRY {
/* Prepare the precomputation table. */
for (i = 0; i < (1 << (ED_WIDTH - 2)); i++) {
ed_null(t[i]);
ed_new(t[i]);
}
/* Compute the precomputation table. */
ed_tab(t, p, ED_WIDTH);
/* Compute the w-NAF representation of k. */
l = sizeof(naf);
bn_rec_naf(naf, &l, k, EP_WIDTH);
ed_set_infty(r);
for (i = l - 1; i > 0; i--) {
n = naf[i];
if (n == 0) {
/* This point will be doubled in the previous iteration. */
r->norm = 2;
ed_dbl(r, r);
} else {
ed_dbl(r, r);
if (n > 0) {
ed_add(r, r, t[n / 2]);
} else if (n < 0) {
ed_sub(r, r, t[-n / 2]);
}
}
}
/* Last iteration. */
n = naf[0];
ed_dbl(r, r);
if (n > 0) {
ed_add(r, r, t[n / 2]);
} else if (n < 0) {
ed_sub(r, r, t[-n / 2]);
}
/* Convert r to affine coordinates. */
ed_norm(r, r);
if (bn_sign(k) == RLC_NEG) {
ed_neg(r, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
/* Free the precomputation table. */
for (i = 0; i < (1 << (ED_WIDTH - 2)); i++) {
ed_free(t[i]);
}
}
}
void ed_mul_slide(ed_t r, const ed_t p, const bn_t k) {
ed_t t[1 << (EP_WIDTH - 1)], q;
int i, j, l;
uint8_t win[RLC_FP_BITS + 1];
ed_null(q);
if (bn_is_zero(k) || ed_is_infty(p)) {
ed_set_infty(r);
return;
}
TRY {
for (i = 0; i < (1 << (EP_WIDTH - 1)); i ++) {
ed_null(t[i]);
ed_new(t[i]);
}
ed_new(q);
ed_copy(t[0], p);
ed_dbl(q, p);
#if defined(EP_MIXED)
ed_norm(q, q);
#endif
/* Create table. */
for (i = 1; i < (1 << (EP_WIDTH - 1)); i++) {
ed_add(t[i], t[i - 1], q);
}
#if defined(EP_MIXED)
ed_norm_sim(t + 1, (const ed_t *)t + 1, (1 << (EP_WIDTH - 1)) - 1);
#endif
ed_set_infty(q);
l = RLC_FP_BITS + 1;
bn_rec_slw(win, &l, k, EP_WIDTH);
for (i = 0; i < l; i++) {
if (win[i] == 0) {
ed_dbl(q, q);
} else {
for (j = 0; j < util_bits_dig(win[i]); j++) {
ed_dbl(q, q);
}
ed_add(q, q, t[win[i] >> 1]);
}
}
ed_norm(r, q);
if (bn_sign(k) == RLC_NEG) {
ed_neg(r, r);
}
}
CATCH_ANY {
THROW(ERR_CAUGHT);
}
FINALLY {
for (i = 0; i < (1 << (EP_WIDTH - 1)); i++) {
ed_free(t[i]);
}
ed_free(q);
}
}